[MPlayer-dev-eng] running a program with a keystroke - passing playing filename to it

[Kevin DeKorte]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/21/2010 12:00 PM, Elias Gabriel Amaral da Silva wrote:
> 2010/12/21 Clément Bœsch <ubitux at gmail.com>:
> 
>>> [...]
>>> diff --git a/DOCS/tech/slave.txt b/DOCS/tech/slave.txt
>>> index e31a9f4..5bcf074 100644
>>> --- a/DOCS/tech/slave.txt
>>> +++ b/DOCS/tech/slave.txt
>>> @@ -508,6 +508,11 @@ run <value>
>>>      Run <value> as shell command. In OSD menu console mode stdout and stdin
>>>      are through the video output driver.
>>>
>>> +    It expands properties inside the command. Due to an unfortunate
>>> +    syntax clash, it *looks* like those properties are shell variables,
>>> +    but then aren't. (for example, in run "echo ${filename}",
>>           ^^^^
>>           they?
> 
> oh yes, that was a typo, thanks

I'm a little concerned that this patch allows mplayer to execute pretty
much any command available at the OS level. I know it is not running as
root, but it still concerns me a bit.

Kevin


- -- 
Get my public GnuPG key from
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x7D0BD5D1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0RGdcACgkQ6w2kMH0L1dEiJwCeLrBxLCNkCXUfxMWA3OTTKyOE
qq4An0vX6a9jjI83THTZwBMPYfO9QIbx
=V1M2
-----END PGP SIGNATURE-----